SOC 2 Bridge Letter Template Vendors Can Use With Risk Teams

A SOC 2 bridge letter is a short interim assurance letter, sometimes called a gap letter, that self-attests to continued control performance between the end of your last SOC 2 report and the date a customer needs coverage. It bridges a reporting gap for a short, limited period, and it carries real limits: it's a self-attestation, not an audited opinion, and it never replaces the SOC 2 report it refers back to.

TL;DR:

• Most bridge letters are self-issued by the service organization and should reference the previous SOC 2 report, its type, and coverage period without implying new audit work.
• Bridge periods are typically limited to three months to maintain credibility, with longer gaps indicating the need for an accelerated audit rather than an extended letter.
• Reviewers expect the letter to clearly confirm that controls remained stable during the gap and provide contact details and links to verification resources.
• Repeated or extended bridge letters suggest the organization should adopt continuous controls monitoring or update their audit cycle for better risk management.
• Using a live Trust Center for ongoing evidence reduces reliance on interim attestations and helps streamline risk review processes.

Table of Contents

• What a SOC 2 bridge letter is and when to use one
• Why organizations provide SOC 2 bridge letters
• What to include in a SOC 2 bridge letter
• Who writes and issues a bridge letter
• How long a bridge letter is valid
• How to draft a SOC 2 bridge letter, plus a template
• Best practices for presenting bridge letters to risk teams
• Our take on using bridge letters responsibly
• Reduce bridge letter dependence with a live Trust Center
• FAQ
• Sources

What a SOC 2 bridge letter is and when to use one

A SOC 2 report, whether Type I or Type II, covers a fixed period. Type I assesses control design at a single point in time, while Type II assesses operating effectiveness across a review window, often six to twelve months. Once that window closes, your organization needs something to cover the days or weeks before the next report is ready, and that's exactly where a bridge letter steps in.

Several common situations create this kind of gap, and we see the same patterns across most vendor relationships:

• A customer's fiscal year or renewal date falls between your SOC 2 reporting periods.
• Your auditor's schedule pushes the new report past its expected delivery date.
• A deal or renewal closes faster than your audit cycle allows.

A bridge letter works well for these short, predictable gaps. It is not appropriate as a long-term substitute for an audit, and it should never be offered as proof that controls were independently re-examined during the gap period. For background on how SOC reports fit into the broader attestation landscape, our guide to SOC report types breaks down why security teams ask for SOC 2 Type 2 specifically.

Why organizations provide SOC 2 bridge letters

Procurement and security review cycles rarely wait for audit calendars to align, so bridge letters exist to keep deals moving without asking a customer to simply trust that nothing changed. A well-prepared letter gives a vendor's security team something concrete to attach to a risk file while the next SOC 2 report is finalized.

Third-party risk reviewers generally treat a bridge letter as short-term interim comfort rather than hard evidence. They expect it to reference the prior report, state the gap dates plainly, and avoid any language suggesting fresh audit work took place.

Several alternatives reduce how often you need to lean on this tool at all, including adopting SOC as a Service solutions that provide continuous monitoring and managed SOC capabilities:

• Rolling or staggered audit schedules that shorten the natural gap between reports.
• Continuous control monitoring that produces evidence between formal audit cycles.
• A maintained Trust Center that gives reviewers ongoing access to current compliance artifacts.

Our overview of SOC 2 requirements covers how these controls map to buyer expectations in more detail.

What to include in a SOC 2 bridge letter

A bridge letter earns its credibility through precision, not length. Reviewers want to confirm five things quickly, so the letter should make each one unmistakable.

1. Service organization identity: full legal name and the system or service the letter covers.
2. Referenced SOC 2 report: type (I or II) and the exact period it covered.
3. Bridge period dates: the specific start and end dates the letter is attesting to.
4. Affirmative statement on material changes: a clear sentence confirming whether controls changed materially during the gap, and if so, how.
5. Signature and contact information: a named, authorized signatory and a way to follow up with questions.

Beyond those fields, linking to a Trust Center or evidence repository gives reviewers somewhere to verify the claims, and a brief note on any changes and how they were mitigated adds real weight.

Pro Tip: Write the letter in plain self-attestation language, such as "to the best of our knowledge," and avoid any phrasing that could be read as implying the auditor reviewed this specific period.

Who writes and issues a bridge letter

In standard practice, the service organization itself prepares and signs the bridge letter, not the auditor. This is consistent with how SOC 2 auditors typically operate: their opinion applies to the period they examined, and they rarely issue new ad-hoc attestations for short gaps between engagements.

• Vendor self-attestation is the common model, and Microsoft's own SOC 2 documentation describes bridge letters issued this way, typically on a quarterly cadence, to attest to the prior three-month period.
• Auditor-issued letters are far less common and come with different expectations, according to AICPA guidance, which treats the audited SOC 2 report as the authoritative attestation and bridge letters as something distinct from it.
• If an auditor is involved in any capacity, the letter should state exactly what that involvement was rather than letting the reader assume a new examination occurred.

How long a bridge letter is valid

Most vendors cap bridge letter coverage at a short interim period, commonly up to three months, a window that aligns with Microsoft's quarterly issuance pattern for its own bridge letters. Longer gaps start to strain the credibility of a self-attestation, since the letter is standing in for audited evidence that doesn't yet exist.

The bridge period should align naturally with your prior report's end date and the customer's actual need, not stretch to cover convenience. If you find yourself issuing repeated bridge letters back to back, or extending one beyond a quarter, that's a signal to reviewers, and to your own team, that your audit cadence needs attention.

How to draft a SOC 2 bridge letter, plus a template

Drafting a bridge letter is straightforward once you have the right inputs lined up. Work through this checklist before anything goes out the door:

1. Confirm the exact start and end dates of your most recent SOC 2 report.
2. Determine whether any material control changes occurred during the gap, and document them if so.
3. Route the draft through legal and control owners for review before signature.
4. Confirm the signatory has the authority to attest on behalf of the organization.
5. Attach or link supporting evidence, such as a Trust Center page, where reviewers can verify claims directly.

A simple field structure keeps the letter consistent across customers:

The body of the letter itself can follow a simple pattern: state the organization name and the system covered, reference the prior SOC 2 report by type and dates, declare the bridge period, affirm whether controls remained consistent, and close with a signature block. Linking the letter to your Trust Center, along with a note on when the next audit is scheduled, gives reviewers a path to verify everything without a follow-up email. Our breakdown of SOC 2 report types is a useful reference when deciding how to describe the referenced report accurately.

Best practices for presenting bridge letters to risk teams

The fastest way to get a bridge letter accepted is to make it easy to verify. Pairing the letter with a live Trust Center or evidence portal cuts down on the back-and-forth that typically follows a bare attestation, since reviewers can check controls mapping, control owners, and recent change logs themselves instead of emailing you for it.

Preparing a standard evidence packet in advance, covering the same questions reviewers ask every time, saves your team real hours across a renewal season. And if a buyer's risk tier or deal size genuinely calls for current audited assurance rather than interim attestation, the right move is to accelerate the next audit or stand up continuous monitoring rather than stretch the bridge letter past what it was designed to do.

Pro Tip: Keep a single, current evidence packet ready year-round so a bridge letter request never catches your team by surprise.

Our take on using bridge letters responsibly

We think bridge letters are useful exactly as far as their name suggests: a bridge, not a destination. When a gap is short and controls genuinely haven't changed, an honest letter serves everyone well. When the gap keeps growing, the better answer is accelerating the audit, not writing a longer letter. Document everything, and never claim more than the letter can support.

— Gaspard

Reduce bridge letter dependence with a live Trust Center

Every bridge letter you write is a stopgap for a question that a continuously available evidence source could answer on its own. That's the gap our Trust Center is built to close: a customer-facing page where control documentation, past SOC 2 reports, and recent updates stay visible between audit cycles, so reviewers can self-serve instead of waiting on a new letter.

Pairing that with our Questionnaire Automation Tool means the same evidence feeding your Trust Center also powers faster responses to the security questionnaires that usually accompany a bridge letter request:

• A maintained Trust Center gives buyers ongoing access to current evidence instead of a point-in-time letter.
• A platform may connect to multiple third-party risk management tools, so evidence reaches reviewers wherever they already work.
• For due-diligence-heavy reviews, our Fiduciary-Grade DDQ Automation shortens the turnaround on the detailed questionnaires that often follow a bridge letter.

If repeated bridge letters have become a routine part of your renewal cycle, it's worth seeing what a live evidence setup looks like for your team.

FAQ

What is a SOC 2 bridge letter?

A SOC 2 bridge letter is a self-attestation issued by a service organization to confirm that its controls remained consistent during the gap between two SOC 2 reporting periods. It references the prior report and states the specific dates it covers, but it does not carry the weight of an auditor's opinion.

What is the purpose of the bridge letter?

A bridge letter exists to give customers and risk reviewers interim comfort when a renewal, deal, or review falls between SOC 2 reports. It keeps procurement and risk processes moving without implying that a new audit took place during the gap.

Who writes the bridge letter?

The service organization itself typically writes and signs the bridge letter, as reflected in how Microsoft issues its own bridge letters on a quarterly basis. Auditor-issued letters are uncommon and should clearly state the auditor's actual role if one is involved.

How long can a bridge letter be used?

Most organizations cap bridge letter coverage at a short interim period, commonly up to three months, matching the cadence vendors like Microsoft use for their own quarterly letters. Coverage beyond that window weakens the letter's value as a stand-in for audited evidence and often signals it's time to accelerate the next audit.

Sources

• System and Organization Controls (SOC) 2 Type 2 - Microsoft Compliance | Microsoft Learn
• AICPA: SOC for Service Organizations

Recommended

• SOC 2 Sample Report: Key Insights for Security Teams
• SOC 2 Type Reports: Reducing Security Response Time
• 7 Steps to Create a Complete SOC 2 Compliance Checklist
• SOC 2 compliance guide for tech and finance in 2026